Qubes OS 4.3.0
This tutorial helps beginners who are curious about Qubes OS to play around with it without needing an extra computer.
Qubes OS isn't really Linux
Technically, it's a Xen hypervisor, but practically, it uses Linux Debian and Fedora VMs on top, so for the user experience, it's basically Linux, so some basic experience with Ubuntu, Mint, etc. will definitely help you.
Installation on a physical machine
If you decide to try Qubes OS on a physical machine, you'll need to cerate an installation USB Stick from the downloaded ISO file.
During testing I noticed that creating installation media with Rufus on Windows 11 always failed, however, it worked with BalenaEtcher.
Pre-Existing Conditions (hehe 😁)
This tutorial assumes the following things about you:
You're a beginner, but you have at least tried to use a major Linux distro like Ubuntu, Mint, etc.
Your main operating system is Windows 11.
You have a relatively modern computer with virtualization support activated in BIOS/UEFI (Intel VT-x or AMD-V).
Your computer has at least 16GB of RAM: You'll need at least 8GB of those 16GB to power a virtual computer running on top of your physical computer. The more the merrier.
You need at least 40GB of space on your computer for the virtual machine disk, which simulates a physical hard drive. At least 80GB is required if you want to seriously test the functionality.
You have already installed VirtualBox.
You have already downloaded the Qubes OS ISO image file.
Setting up the VM in VirtualBox
Set VirtualBox Preferences
Open VirtualBox
Open File -> Preferences...
Select "Expert" at the top of the left-side menu: This allows us to adjust the disk settings when creating a VM.
General: Default Machine Folder (optional): You can pre-define a directory on a partition or hard drive with enough space to house all your VMs.
Input -> Virtual Machine -> Host Key Combo: Make sure to select a key or a combination of keys that are easily accessible for you (i.e. "ALT GR" in my case). You'll need this to release your mouse quickly from the VM, so you can use it normally on your computer, otherwise it will only work inside the VM, but not outside of it, and you'd need to press Ctrl+Alt+Del.
Click "OK".
Virtual machine name and operating system
VM Name: Enter any name you like (i.e. "Qubes OS R4.3.0")
VM Folder: Select a location with at least 40GB for the VM (80GB is recommended if you have space)
ISO Image: Select the Qubes OS ISO image file file you already downloaded.
OS Distribution: Fedora
OS Version: Fedora 64-Bit
Uncheck "Proceed with Unattended Installation".
If the new VM setup screen looks different, then you forgot to select "Expert" in settings.
Specify virtual hardware
Base Memory: Enter at least 8192 MB if your physical computer has 16GB of RAM (or 16384 MB if your physical computer has 32GB of RAM), but you can go higher if you have more resources.
Number of CPUs: Again, choose an amount you're comfortable with. Since this is only for testing, I don't need a lot of power for the VM, so I use only 2.
Make sure to select "Use EFI".
Specify virtual hard disk
Disk Size: Enter at least 40,00 GB. I opted for 80GB. The more the merrier.
Hard Disk File Type and Format (optional): You can leave this unchanged, I personally prefer VHD because I can mount it in Windows or add it to Ventoy.
Click "Finish".
But we are not done yet. Before you start the VM, you need to make some changes.
Adjust the VM's Settings
Only select the VM in the VirtualBox main window (don't double click it yet).
Select Machine -> Settings.
Navigate to "Storage" on the left-side menu.
Devices: Select "Controller: SATA".
Attributes: Type: Change into "virtio-scsi".
Check "Use Host I/O Cache".
Devices: Select the actual virtual disk file underneath "Controller: SATA" (i.e. "Qubes OS R4.3.0.vhd").
Check "Solid-state Drive".
Click "OK".
Starting the VM and installing Qubes OS
Installation Menu
The VM should successfully boot from the ISO file and display the installation options.
Click with the mouse anywhere inside the VM. Your mouse and keyboard are now "captured" inside the VM, so any mouse movements or key strokes will only be visible inside the VM.
Select the last option with your keyboard and hit enter to begin the installation: Selecting the latest Kernel seems to be less buggy when installing on a VM.
Release your mouse and keyboard until you need to interact with the VM again.
This is where the "Host Key Combo" you set up earlier comes in handy.
Installation Summary
The next screen will show you the installation options. Notice that options with a red text must be set before the installation can continue.
To change an option, click on it, make the changes you want, and return to the installation summary.
Keyboard
This is straightforward. You can remove or add multiple keyboards by clicking the "+" or "-" buttons:
Here's an example for adding the German langugage: Type the name of the language, then select the variant you prefer, and click "Add":
By clicking the "Options" button on the right side, you can add a keyboard shortcut for switching to a language, but I never needed it:
When done, click "Done" at the upper left corner to return to the installation summary.
Language Support
You can add support for multiple langauges by typing the name of the language in the lower left corner, then selecting a regional variant from the right side:
Here's an example for adding support for German:
When removing the filter in the bottom left corner, you can see that both English and German are supported:
When done, click "Done" in the upper left corner to return to the installation summary.
Time & Date
To choose the correct time zone, first select the region from the drop-down list, then the city:
If I want to set it up to Berlin, Germany, I'd need to select "Europe" first, then Berlin:
You can also adjust the date and time settings if not in sync with your physical computer:
When done, click "Done" in the upper left corner to return to the installation summary.
Software Selection
You don't need to change these settings unless you need options for visual/hearing impairment or a special desktop experience:
Desktop accessibility: Tools for screen readers, high contrast modes.
Sway Window Manager: A tiling window manager using Wayland. This is an alternative/advanced option for users who prefer a keyboard-driven, tiling interface over the standard Xfce desktop.
When done, click "Done" in the upper left corner to return to the installation summary.
Installation Destination
This is tricky, becuase there is only one disk (the virtual disk), any you already selected it. All you have to do is click on it once more and a check mark will appear next to it:
This is what it should look like:
There's no need to check "Encrypt my data" for testing Qubes on a VM, but if you want to, you'll habe to enter the passphrase when you click "Done":
When done, click "Done" in the upper left corner to return to the installation summary.
Reboot
Initial Setup
Once you boot Qubes OS for the first time, you'll see this screen:
Yes, "QUBES OS" is a button. Clicking it takes you to the next step:
To keep this simple, don't change any of the options and click "Done" in the upper left corner. These options are perfectly fine for a beginner to test Qubes OS, here's a quick rundown of them to help you understand the security options in Qubes OS:
Templates Configuration
Templates are the base operating systems that your individual qubes are built from.
Debian/Fedora: These are well known Linux distros for everyday tasks.
Whonix: A privacy-hardened template specifically designed to route all traffic through the Tor network.
Main Configuration
Create default system qubes: This creates the backbone of your system:
sys-net: Handles your physical network hardware (WiFi/Ethernet).
sys-firewall: Sits between sys-net and your application qubes, acting as a firewall.
DispVM (Disposable VM): A throwaway qube that vanishes after use (for opening untrusted files).
Make sys-firewall and sys-usb disposable: This makes those system qubes disposable, meaning they're freshly recreated from their template on each boot. This is a strong security measure because any malware that compromises them is wiped on reboot.
Make sys-net disposable: Similar idea for sys-net. This is slightly more advanced and can occasionally cause minor quirks. It's safe to leave unchecked for now.
Create default application qubes: This creates four pre-named qubes that demonstrate Qubes' isolation model perfectly:
personal for your private life.
work for professional tasks.
untrusted for sketchy websites or unknown files.
vault a network-less qube ideal for storing passwords and sensitive data, since it can never be remotely attacked.
Use a qube to hold all USB controllers: In Qubes, even USB devices are a threat vector. This option quarantines your USB hardware into its own isolated qube so that a malicious USB device can't directly attack your system:
Use sys-net qube for both networking and USB: Skip this; combining them weakens isolation.
Automatically accept USB mice: Convenient but slightly less secure. Fine to enable if you use a USB mouse.
Automatically accept USB keyboard: The screen notes this is discouraged if a non-USB keyboard is available. If your only keyboard is USB, you'll need this, otherwise leave it unchecked.
Create Whonix Gateway and Workstation qubes: This sets up a full Tor-routed environment.
sys-whonix acts as a Tor gateway
anon-whonix is a workstation that routes all its traffic through it anonymously. Even if anon-whonix is compromised, the attacker only sees Tor traffic.
Enable system and template updates over Tor: This routes your system updates through Tor, which enhances privacy but can be noticeably slow. Leave this unchecked for now and enable it later if you specifically need it.
Advanced Configuration
Create 'vm-pool' LVM thin pool: This is the storage backend for all your qubes. LVM thin provisioning means disk space is allocated efficiently — a qube only uses as much real disk space as it actually needs, rather than its full allocated maximum. Keep this selected unless you have a specific reason to use an existing pool.
When done, click "Done" in the upper left corner to return to the initial setup screen:
Now click "FINISH CONFIGURATION" in the lower right corner.
Last updated